General rules for the procurement of data systems

Whenever new data systems are acquired, a pre-defined procurement process and rules are followed. The rules ensure that the supplier is able to guarantee an adequate level of security, taking into account the priority of the system.

Agreement between a cloud service provider and the organization must include requirements for protecting the organization's data and the availability of services, e.g. in the following ways:

• providing a solution based on generally accepted architecture and infrastructure standards in the industry
• managing access rights to meet organizational requirements
• implementing malware control and protection solutions
• processing and storage of the organization's sensitive data in approved locations (e.g. a certain country or legislative area)
• providing support in the event of a data security breach
• ensuring that the organization's data security requirements are met also in subcontracting chains
• li>providing support in the collection of digital evidence
• providing sufficient support when the organization wants to terminate the use of the service
• required backup and secure management of backups, where applicable
• information owned by the organization (possibly, e.g. source code, data filled/created for the service) restored upon request or when the service ends
• notification requirement in relation to significant changes (such as infrastructure, important features, information location or use by subcontractors)

Kaikki hankitun palvelun/sovelluksen/järjestelmän turvallisuuteen oleellisesti vaikuttava koodi on tarkastettavissa (esim. mahdolliset takaportit, turvattomat toteutukset).

Whenever new data systems are acquired or developed, pre-defined security rules are followed, taking into account the priority of the system. The rules ensure that adequate measures are taken to ensure the security of the data and data processing in the system.

The organization has defined the certifications or standards required of key partners. Commonly recognized standards related to cyber security include:

• ISO 27001 (information security management system)
• SOC2 (general security, also called SSAE 16)
• ISO 27701 (data protection management system)
• ISO 27017 (cyber security in cloud services) or ISO 27018 (data protection in cloud services)
• other popular e.g. NIST (general), CSA (cloud software), PCI DSS (card payments and data)

Certifications required from partners can make organization's own partner management more efficient and provide good evidence of a particular level of security or privacy of the partner.

Only acquire IoT devices that have built-in security functions and will receive security updates.

It is also important to make sure that it is possible to change all standard passwords and the IoT devices can be forced to only use networks that the organisation has control over.

Organization must ensure in advance that the acquired data systems are secure. In order to ensure this, the supplier of the important data system to be acquired must be required to provide sufficient security-related clarifications already at the procurement stage.

The supplier must clarify at least the following:

• There is a system description of the service. Based on the description of the service provider, you must be able to assess the general suitability of the service in question for the customer's use case. The system description must show at least
• The service and implementation models of the service, as well as the related service level agreements (Service Level Agreements, SLAs).
• The principles of the life cycle (development, use, decommissioning) of service provision procedures and security measures, including control measures.
• Description of the infrastructure, network and system components used in the development, maintenance/management and use of the service.
• Principles and practices of change management, especially processes for handling changes affecting security.
• Processing processes for significant events deviating from normal use, for example operating procedures in case of significant system failures.
• Role and division of responsibilities related to the provision and use of the service between the customer and the service provider. The description must clearly show the actions that are the customer's responsibility in ensuring the safety of the service. The service provider's responsibilities must include the obligation to cooperate, especially in the investigation of abnormal situations.
• Functions transferred or outsourced to subcontractors.

Determined system portfolio management means a clear picture of the organization's system as a whole, the benefits of different systems and future needs.

The aim of system portfolio management is to achieve e.g.:

• efficiency benefits by understanding the whole and e.g. the possibilities of integrations
• eliminate duplication
• save on unnecessary licensing costs
• control the number of suppliers
• facilitate staff guidance

The processing agreement binds the actions of the data processor (such as the system vendor).

It can be important for us to ensure an important partner takes responsibility of e.g. access control (logging) and data recovery at the end of the contract according to our preferred policies.